docs(target-selection): a fixture may prove a mechanism; only a fresh box may prove a path

The page said which machine is safe to break but not when reusing a test box is
legitimate. That distinction is exactly what surfaced R-120: R-116's closing run
deliberately did a real day-0 from the ISO instead of reusing the standing fixture,
and the fresh box installed the golden's controller -- a release behind -- and showed
the customer the wrong absent-target message. A fixture would have shown a controller
nobody installs.

Adds to the Tier 1 section: a reusable snapshot-reset fixture is the right default
for MECHANISM work (payload capture, fix cycles, claims about code behaviour), while
a fresh day-0 from the ISO is REQUIRED for any claim about the install path, the
golden image, agent publish/vouch or first-boot state -- naming the drift family it
exists to catch (R-111, R-115, R-120).

Also: a fixture must record its provenance (which golden, agent and controller, and
when), because a fixture whose versions drift silently is R-120's mechanism turned
into a permanent installation -- worse than no fixture, since it produces confident
wrong results quickly.

Part 1 of the R-120 task, committed alone and before the bake. Docs only.

documentation/runbooks/target-selection.md

@@ -84,7 +84,29 @@ produced a false "unreachable" verdict (standing rule 2).
 
 Create and destroy freely **on a Tier 0 host**. Two exceptions: **`drill-r50`** is a fixture, not
 scratch; and scratch **customers** outlive their VMs in the hub — delete those too, or they accumulate
-(`sess-c` and `sess-d` are both still there).
+(`sess-c` and `sess-d` were both left behind before anyone noticed).
+
+#### A fixture may prove a mechanism. Only a fresh box may prove a path.
+
+Rebuilding from scratch every time is waste; reusing a box is legitimate — but not for every claim.
+
+- **Reusable fixture** — a snapshot-reset VM on a Tier 0 host. Use it for **mechanism** work: payload
+  capture, fix cycles, anything whose claim is about *code behaviour*. Reset to `virgin` between runs.
+  Fast, repeatable, and the right default for iteration.
+- **Fresh day-0 from the ISO** — required for any claim about the **install path, the golden image,
+  agent publish/vouch, or first-boot state**. Slow, and the only thing that catches the drift family:
+  **R-111** (the golden's agent 17 releases behind), **R-115** (an agent built and deployed but never
+  published), **R-120** (the golden a controller release behind).
+
+**A fixture must record its provenance** — which golden, agent and controller it was built from, and
+when — alongside the VM. A fixture whose versions drift silently is R-120's mechanism turned into a
+permanent installation, and it is *worse* than no fixture, because it produces confident wrong results
+quickly.
+
+**Worked example.** R-116's closing run deliberately did a real day-0 from the v1.25.0 ISO on demo-hp
+instead of reusing the standing fixture. **That is how R-120 surfaced** — the fresh box installed the
+golden's controller, which is a release behind, and showed the customer the wrong absent-target message.
+The fixture would have shown a controller nobody installs.
 
 ## Not established — unknown, not guessed